CVE-2022-1194CWE-1236

Mobile Events Manager < 1.4.8 - Admin+ CSV Injection

published September 16, 2022

CVSS
—
EPSS
1%
Percentile
69.4
In the wild
Unconfirmed
What it is

The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01262 · 69.4th percentile
Weakness
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File
Published
2022-09-16T08:40Z
EPSS history
Timeline
  • 16 SEP 08:40Z
    Mobile Events Manager < 1.4.8 - Admin+ CSV Injection
    cvelistv5